Vtiger Vtiger_crm
72 CVEs affecting Vtiger Vtiger_crm. Latest disclosed: 2025-05-21. Critical: 6, High: 14.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-22807 | Critical | 9.8 | 2021-04-29 | An issue was dicovered in vtiger crm 7.2. Union sql injection in the calendar exportdata feature. |
CVE-2013-3215 | Critical | 9.8 | 2020-01-29 | vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession function. |
CVE-2013-3214 | Critical | 9.8 | 2020-01-28 | vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'. |
CVE-2024-44779 | Critical | 9.6 | 2024-08-29 | A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code… |
CVE-2024-44778 | Critical | 9.6 | 2024-08-29 | A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code i… |
CVE-2024-44777 | Critical | 9.6 | 2024-08-29 | A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in t… |
CVE-2023-38891 | High | 8.8 | 2023-09-14 | SQL injection vulnerability in Vtiger CRM v.7.5.0 allows a remote authenticated attacker to escalate privileges via the getQueryColumnsList function in ReportR… |
CVE-2013-3591 | High | 8.8 | 2020-02-07 | vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution Vulnerability |
CVE-2015-6000 | High | 8.8 | 2020-02-06 | Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtig… |
CVE-2019-19202 | High | 8.8 | 2019-11-21 | In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role by adding roleid=H2… |
CVE-2016-10754 | High | 8.8 | 2019-05-24 | modules/Calendar/Activity.php in Vtiger CRM 6.5.0 allows SQL injection via the contactidlist parameter. |
CVE-2019-11057 | High | 8.8 | 2019-05-17 | SQL injection vulnerability in Vtiger CRM before 7.1.0 hotfix3 allows authenticated users to execute arbitrary SQL commands. |
CVE-2024-42995 | High | 8.3 | 2024-08-16 | VTiger CRM <= 8.1.0 does not correctly check user privileges. A low-privileged user can interact directly with the "Migration" administrative module to disable… |
CVE-2023-46304 | High | 8.1 | 2024-04-30 | modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows the… |
CVE-2013-3212 | High | 8.1 | 2020-01-28 | vtiger CRM 5.4.0 and earlier contain local file-include vulnerabilities in 'customerportal.php' which allows remote attackers to view files and execute local s… |
CVE-2016-4834 | High | 8.1 | 2016-08-01 | modules/Users/actions/Save.php in Vtiger CRM 6.4.0 and earlier does not properly restrict user-save actions, which allows remote authenticated users to create… |
CVE-2016-1713 | High | 7.3 | 2017-04-14 | Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtig… |
CVE-2025-45753 | High | 7.2 | 2025-05-21 | A vulnerability in Vtiger CRM Open Source Edition v8.3.0 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the ZIP import fu… |
CVE-2024-42994 | High | 7.2 | 2024-08-16 | VTiger CRM <= 8.1.0 does not properly sanitize user input before using it in a SQL statement, leading to a SQL Injection in the "CompanyDetails" operation of t… |
CVE-2019-5009 | High | 7.2 | 2019-01-04 | Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo upload field, if the uploaded file is in PNG format and has a size… |